Re: "Sounds like a lawsuit"
They obviously stored and then accessed her debit card payment information in violation of PCI. They are subject to hefty fines as every single transaction counts as a separate violation.
The faulted party is also eligible for damages. She should get a lawyer as soon as possible.